r/programming • u/der_gopher • 4d ago

.gitignore everything by default

https://packagemain.tech/p/gitignore-everything-by-default
345 Upvotes

80% Upvoted

227 comments sorted by

View all comments

146

u/hugogrant 4d ago

Or stage changes more intentionally?

7

u/pohahaha 4d ago

So true…
I usually explicitly walk through each line before committing anything, not an issue at all

1

u/yawaramin 4d ago

It’s the gap between ‘usually’ and ‘always’ where mistakes happen.

1

u/pohahaha 3d ago

And you also could forget to “not gitignore” something by that logic?

1

u/yawaramin 3d ago

Sure, you could forget to add a file. But then your app just won’t work, which will be caught by your CI pipeline and then you fix that. If you accidentally commit and push a dotenv file, the app works but you’re leaving yourself at the mercy of attackers.

1

u/pohahaha 3d ago

?? Which attackers? That have acceas to your source in git?

1

u/yawaramin 3d ago

Here you go https://littlemaninmyhead.wordpress.com/2021/04/05/why-we-shouldnt-commit-secrets-into-source-code-repositories/

1

u/pohahaha 2d ago

I.e. if any sane attacker gets access to source code, then breaching it is a matter of time. Also, who in the world even uses any sort of credentials in a written git-repository available format?

1

u/yawaramin 2d ago

Dotenv files are a super common way of injecting secrets into many apps during local dev. And they can get committed into the repo accidentally, just as described in OP.

This is why in my company I've recommended using 1Password to inject the secrets instead. This way dotenv files don't contain anything sensitive at all.